Accounts payable teams can prevent business email compromise by combining independent vendor verification, payment controls, employee training, and layered email security. The most important rule is simple: never approve a payment or bank account change based solely on an email, even when the message appears to come from a trusted vendor or executive.
Business email compromise, commonly referred to as business email compromise BEC in search queries, is a growing financial risk for US organizations. In 2025, the FBI’s Internet Crime Complaint Center recorded 24,768 BEC complaints and more than $3 billion in reported losses. AP teams are particularly exposed because they manage vendor records, approve invoices, and release payments through workflows that attackers can imitate.
For AP leaders, an accounts payable fraud prevention solution can help automate vendor verification, identify suspicious payment details, and strengthen controls across the procure-to-pay process.
Key Takeaways
• Business email compromise targets trust, urgency, and familiar payment workflows rather than relying only on malware.
• Vendor impersonation commonly involves compromised email accounts, fake invoices, or fraudulent bank account change requests.
• AP teams should verify payment changes through an independently sourced phone number and require additional approval for high-value payments.
• Security protocols such as DMARC, SPF, DKIM, multi factor authentication, and phishing-resistant MFA provide stronger layered protection.
• Security awareness training and human risk management help employees recognize, report, and stop suspicious payment requests.
What Is Business Email Compromise and Why Are AP Teams at Risk?
Business email compromise is a form of fraud in which criminals impersonate a trusted person or compromise a legitimate email account to influence a financial or sensitive business decision. In accounts payable, the objective is often to redirect a payment to an account controlled by the attacker.
A BEC attack may involve a fake invoice, a compromised vendor mailbox, a lookalike domain, or an urgent payment request from a senior executive. Attackers may also use phishing links to steal AP employees’ credentials and gain access to payment-related conversations.
The risk is amplified by the trust embedded in vendor relationships. AP employees already expect invoices, payment reminders, purchase order references, and occasional account changes from suppliers. Attackers exploit that familiarity to make fraudulent requests appear routine.
The financial impact extends beyond the original payment. A successful attack may cause direct losses, delayed payments to legitimate suppliers, investigation costs, audit issues, and reputational damage.
The FBI recommends verifying changes to account numbers or payment procedures by calling the person or organization using a trusted number, rather than the contact information provided in the suspicious message.
How Does a BEC Attack Target Accounts Payable?
BEC attacks target AP by inserting fraudulent instructions into normal payment workflows. Criminals may compromise an inbox, imitate a vendor, impersonate an executive, or steal credentials that provide access to payment systems.
The attack often follows this pattern:
- The attacker researches the company, suppliers, employees, and payment cycles.
- The attacker gains access to an email account or creates a convincing impersonation.
- The attacker monitors conversations or starts a new payment-related exchange.
- The attacker requests a payment, invoice approval, or bank account change.
- The AP employee processes the request within an existing workflow.
- The payment is sent to an account controlled by the criminal.
The most dangerous attacks do not always look unusual. They may use accurate invoice numbers, familiar project names, previous email content, and realistic signatures. This is why the appearance of an email cannot be treated as proof of authenticity.
How Do Compromised Vendor Emails Lead to Fake Invoices?
Compromised vendor emails allow attackers to exploit an established business relationship. Instead of creating a completely new supplier identity, the criminal uses the vendor’s real account or impersonates the vendor closely enough to influence the AP team.
An attacker may silently monitor a supplier’s mailbox for days or weeks, learning which services the vendor provides, when invoices are normally sent, who approves payments, and how the company communicates.
The attacker may then send a fraudulent invoice that matches the vendor’s usual documents. In other cases, the criminal joins an existing email thread and requests a change to the bank account. Because the conversation is already familiar, the request may not receive the same scrutiny as a new supplier setup.
Vendor email compromise is a specific form of BEC that focuses on trusted third-party relationships and payment redirection. Read more in this guide to vendor email compromise.
Why Can a Legitimate Invoice Still Result in Fraud?
Invoice fraud is particularly difficult to detect when the invoice itself is legitimate but the payment details have been altered. The goods or services may have been delivered, the purchase order may be valid, and the amount may be correct. The only fraudulent element may be the destination account.
AP teams should therefore separate two questions:
• Is this invoice valid?
• Does the bank account belong to the intended vendor?
Approving an invoice does not automatically validate the payment destination. Before releasing funds, AP teams must confirm that the vendor owns the account listed in the payment instructions.
How Does Executive Impersonation Divert Payments?
Executive impersonation, sometimes called CEO fraud, occurs when criminals pretend to be a senior leader and pressure an employee to make a payment or disclose sensitive information.
The request may appear to come from a CEO, CFO, business owner, or department head. It often includes an urgent deadline, a request to bypass the normal approval process, or a demand for confidentiality.
Attackers exploit authority because AP employees may hesitate to challenge a senior executive. They also use urgency to reduce the time available for verification.
A request such as “Please process this immediately and do not discuss it with anyone” should be treated as a control trigger, not as an instruction to move faster.
AP teams should establish a policy that all unusual executive payment requests require independent verification. This may involve calling the executive through a known internal number, confirming the request with the executive’s assistant, or requiring a second approver who is outside the original email chain. These controls are especially important because CEO phishing attacks often rely on urgency and authority to bypass normal review. Trustpair’s CEO phishing email examples show how criminals use false invoice payments, document access requests, gift card scams, and other executive impersonation tactics.
Which BEC Scam Signals Should AP Employees Recognize?
The most important BEC warning signs are unusual timing, changed payment details, mismatched sender information, and pressure to bypass established controls.
What Should Employees Check in the Sender Address?
The sender’s display name may look correct while the sender address contains a misspelled domain, an extra character, a different top-level domain, or a suspicious reply-to address.
Employees should inspect the complete sender address rather than relying on the name displayed in the inbox.
When Should a Payment Request Be Considered Unusual?
A request deserves additional review when it arrives outside the vendor’s normal billing cycle, just before a holiday, late in the day, or immediately before a payment run.
Timing alone does not prove fraud, but unusual timing combined with urgency or a change in payment details should stop the transaction until verification is complete.
Why Are Secrecy and Pressure Important Warning Signs?
Requests to keep a payment confidential, avoid a normal approver, or communicate only through email are high-risk signals. Attackers may also claim that a payment is overdue, a contract is at risk, or an executive will be dissatisfied if the request is delayed.
These tactics are designed to make employees reveal sensitive information or bypass normal controls.
How Should AP Teams Verify Vendors Before Approving Payment Changes?
AP teams should verify every sensitive payment change through an independent channel before updating the vendor record or releasing funds.
Use an Independently Sourced Contact
The AP employee should use the vendor’s phone number or contact information already stored in the approved vendor master file. They should never use the phone number, email address, or link included in the change request.
Ask the Vendor to State the Details
During the callback, the vendor should state the relevant payment information rather than simply confirming details read aloud by the AP employee. This reduces the risk that the caller is simply agreeing with fraudulent information.
Apply Dual Approval
A second authorized employee should review the request and verification evidence, especially for high-value payments, international transfers, or changes involving a new country.
Document the Decision
The verification record should include the date and time of the call, the person contacted, the number used, the source of the contact information, the information confirmed, and the final decision.
Monitor Future Changes
A vendor that passes one verification can still be targeted later. Sensitive vendor data should be monitored throughout the supplier lifecycle.
Callback procedures are one of the most established controls for payment diversion, but they are only effective when the contact information is independently sourced and the outcome is documented.
Why Do Most Email Security Tools Not Stop Every BEC Attack?
Most email security tools remain important, but they are not sufficient against BEC because many attacks contain no malware, malicious attachment, or obvious technical indicator.
BEC often relies on social engineering and impersonation rather than malicious code. A plain-text message from a compromised legitimate mailbox may appear to be normal business communication and bypass traditional email filters.
This is why AP teams need payment-specific controls in addition to email security tools.
What Are Domain-Based Message Authentication Protocols?
Domain-based message authentication uses SPF, DKIM, and DMARC to help verify that emails were sent by authorized sources.
Organizations should configure these security protocols for their domains and move DMARC from monitoring toward enforcement after reviewing legitimate sending sources.
CISA recommends using DMARC together with SPF and DKIM to verify the sending server and help reject spoofed messages that impersonate an organization’s domain.
Additional controls should include alerts for suspicious reply-to addresses, detection of lookalike and newly registered domains, external sender warnings, and monitoring for mailbox rules that hide or forward payment-related messages.
These controls primarily protect the company’s own domain and email environment. They do not replace the need to validate a vendor’s identity and bank account before payment.
How Can AP Teams Block BEC Attacks Enabled by Credential Theft?
AP teams can block BEC attacks by protecting employees from malicious links and strengthening access controls around email and payment systems.
Attackers may use fake Microsoft 365 login pages, fraudulent vendor portals, or document-sharing pages to steal credentials. Once inside an account, they can monitor conversations, create forwarding rules, and send realistic payment instructions.
Organizations should scan URLs before employees interact with them, block known malicious domains, and apply security inspection to links received through email.
How Does Multi Factor Authentication Reduce Account Takeover Risk?
Multi factor authentication adds an additional verification step beyond a password. It can reduce the impact of stolen credentials, particularly when organizations use phishing-resistant methods.
NIST identifies FIDO authenticators used with WebAuthn as a widely available form of phishing-resistant authentication.
Payment staff should also be restricted from accessing payment applications through unmanaged devices or unfamiliar locations without additional verification.
MFA is important, but employees should not approve a transaction solely because an MFA prompt appeared. Attackers may use stolen sessions or social engineering to make a fraudulent login appear legitimate.
How Does Human Risk Management Reduce BEC Exposure?
Human risk management begins with identifying where people can create, change, approve, or release payments.
Organizations should map responsibilities across the full procure-to-pay process, including vendor onboarding, vendor master data maintenance, invoice entry, payment proposal creation, payment approval, and bank file transmission.
The highest-risk roles are usually those that can change vendor records or release funds. These permissions should not be concentrated in one individual.
Effective controls include separating vendor master data maintenance from payment approval, requiring a second approver for bank account changes, limiting administrative permissions, and reviewing privileged access regularly.
Segregation of duties is particularly important because a single compromised account should not be enough to change a vendor’s bank details and approve the resulting payment.
How Should Security Awareness Training Prepare AP Employees?
Security awareness training is more effective when it reflects the payment scenarios AP employees actually encounter. Generic phishing examples may not prepare finance teams for realistic vendor impersonation or executive fraud.
Training should include scenarios involving:
• A vendor requesting a bank account change
• A fake overdue invoice
• A confidential wire transfer from an executive
• A phishing link disguised as a shared invoice
• A message that continues a legitimate email thread
Employees should learn what to do, not only what to notice. They should know how to stop interacting with the message, report it through the approved security channel, notify the AP manager, and contact the vendor independently when a payment change is involved.
Training results should be used to improve controls rather than punish individuals. A failed simulation may indicate that the reporting process is unclear or that employees lack the authority to pause a payment.
How Can Continuous Monitoring Detect an Active BEC Attack?
Continuous monitoring can identify signs of compromise before a fraudulent payment is released. Monitoring should cover both the email environment and the vendor payment process.
Monitor Mailbox Forwarding Rules
Attackers may create rules that forward, hide, or delete messages involving invoices and payment instructions. These rules can allow criminals to monitor communication without being noticed.
Investigate Unusual Vendor Communication
Warning signs include a sudden change in writing style, new recipients, unusual sending times, or a vendor initiating conversations from a new address.
Review Impossible-Travel Login Events
A login from geographically distant locations within an impossible timeframe may indicate stolen credentials or an active account takeover.
Monitor Lookalike Domains
Criminals may register domains that imitate vendors, executives, or financial institutions. Monitoring domain registrations can help identify impersonation infrastructure before it is used.
Track Vendor Master Data Changes
Changes to bank accounts, tax information, addresses, contacts, or payment terms should be logged and reviewed. Fraudsters may alter contact details before attempting to change payment instructions.
The strongest approach correlates these signals. A new mailbox forwarding rule combined with a vendor bank account change should receive immediate investigation.
What Should AP Teams Do After a Successful BEC Attack?
AP teams should act immediately after a successful BEC attack because recovery becomes more difficult once funds move through multiple accounts.
Freeze Pending Payments
Stop any payment connected to the suspicious email, vendor record, beneficiary, or compromised account.
Contact the Bank Immediately
Use the bank’s established fraud or treasury contact information. The FBI advises organizations to contact the financial institution immediately and request that it contact the receiving institution.
IC3 also recommends requesting a recall or reversal as soon as the fraud is recognized.
Secure Compromised Accounts
Reset credentials, revoke active sessions, remove malicious forwarding rules, and review MFA settings. Involve the security team before restoring normal access.
Preserve Evidence
Retain emails, headers, attachments, login records, vendor records, approval logs, payment files, call notes, and bank communications. Do not delete the suspicious message.
Escalate and Report
Notify finance leadership, information security, legal, risk, and executive stakeholders according to the incident response plan.
Organizations should also consider reporting BEC to the FBI’s Internet Crime Complaint Center, regardless of the amount involved.
How Should AP Teams Measure BEC Prevention Performance?
BEC prevention should be measured through operational indicators, not only the number of successful fraud incidents.
AP leaders should track vendor verification completion rates, payment change exception rates, suspicious email reporting speed, phishing simulation results, and the time required to freeze a suspicious payment.
Near misses are especially valuable. An attempted fraud that was stopped before payment can reveal weaknesses in vendor verification, approval workflows, security awareness training, or monitoring.
Every confirmed incident and near miss should result in a documented improvement, such as a policy change, workflow update, access restriction, or new training scenario.
An effective BEC program makes it easy for employees to pause a payment, report a concern, and obtain timely support. Controls that exist only on paper will not protect AP teams during a high-pressure request.